certvalidator

This library started as a fork of wbond/certvalidator with patches for pyHanko, but has since diverged considerably from its parent repository.

GitHub issues are disabled on this repository. Bug reports regarding this library should be submitted to the pyHanko issue tracker. Similarly, questions regarding this library's usage can be asked in the pyHanko discussion forum.

pyhanko-certvalidator is a Python library for validating X.509 certificates paths. It supports various options, including: validation at a specific moment in time, whitelisting and revocation checks.

Features
Current Release
Installation
License
Documentation
Continuous Integration
Testing

Features

X.509 path building
X.509 basic path validation
- Signatures
  - RSA (including PSS padding), DSA, ECDSA and EdDSA algorithms.
- Name chaining
- Validity dates
- Basic constraints extension
  - CA flag
  - Path length constraint
- Key usage extension
- Extended key usage extension
- Certificate policies
  - Policy constraints
  - Policy mapping
  - Inhibit anyPolicy
- Failure on unknown/unsupported critical extensions
Blacklisting hash algorithms
Revocation checks
- CRLs
  - Indirect CRLs
  - Delta CRLs
- OCSP checks
  - Delegated OCSP responders
- Disable, require or allow soft failures
- Caching of CRLs/OCSP responses
CRL and OCSP HTTP clients
Point-in-time validation
Name constraints
Attribute certificate support

Current Release

pypi

Dependencies

asn1crypto
cryptography
uritools
oscrypto
requests or aiohttp (use the latter for more efficient asyncio, requires resource management)
Python 3.7 or higher

Note on compatibility

Starting with pyhanko-certvalidator version 0.17.0, the library has been refactored to use asynchronous I/O as much as possible. Most high-level API entrypoints can still be used synchronously, but have been deprecated in favour of their asyncio equivalents. As part of this move, the OCSP and CRL clients now have two separate implementations: a requests-based one, and an aiohttp-based one. The latter is probably more performant, but requires more resource management efforts on the caller's part, which was impossible to implement without making major breaking changes to the public API that would make the migration path more complicated. Therefore, the requests-based fetcher will remain the default for the time being.

Installation

pip install pyhanko-certvalidator

License

certvalidator is licensed under the terms of the MIT license. See the LICENSE file for the exact license text.

Testing

Test framework

Tests are written using pytest and require an asynchronous test case backend such as pytest-asyncio.

Test cases

The test cases for the library are comprised of:

Public Key Interoperability Test Suite from NIST
OCSP tests from OpenSSL
Various certificates generated for bespoke X.509 certificate validation scenarios

Existing releases can be found at https://pypi.org/project/pyhanko-certvalidator.

Release files for pyhanko-certvalidator 0.32.1

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for pyhanko-certvalidator 0.32.1
File	Size	Uploaded
pyhanko_certvalidator-0.32.1.tar.gz	597.2 kB	Sep 10, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for pyhanko-certvalidator 0.32.1
File	Interpreter	ABI	Platform	Reset
pyhanko_certvalidator-0.32.1-py3-none-any.whl 115.7 kB Sep 10, 2026	Python 3	none	any	Details

Total release size: 712.9 kB

Release files / pyhanko_certvalidator-0.32.1.tar.gz

Download URL	pyhanko_certvalidator-0.32.1.tar.gz
Size	597.2 kB
Tags	Source
SHA-256 checksum How to use checksums	`4780e5697f9d8a02fb4648a1b8f2cd0df67615cae491298491467ca53c0fc08d`
BLAKE2b-256 checksum How to use checksums	`2d94559f4ffadb51fbc33d0ce8cee34f1a32f1ee6d4ada3495d6e7ef1c9d1a0c`
Upload date	Sep 10, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/MatthiasValvekens/pyHanko
Publishing commit: github.com/MatthiasValvekens/pyHanko/tree/6cd63e82e2ea91e62bdb78d8980c08cc100cdb22

Workflow

Publishing configuration: github.com/MatthiasValvekens/pyHanko/blob/6cd63e82e2ea91e62bdb78d8980c08cc100cdb22/.github/workflows/release.yml
Publishing logs: github.com/MatthiasValvekens/pyHanko/actions/runs/34442484121/attempts/1

Artifact

Subject: pyhanko_certvalidator-0.32.1.tar.gz
SHA-256 checksum: 4780e5697f9d8a02fb4648a1b8f2cd0df67615cae491298491467ca53c0fc08d Verifying attestations

Release files / pyhanko_certvalidator-0.32.1-py3-none-any.whl

Download URL	pyhanko_certvalidator-0.32.1-py3-none-any.whl
Size	115.7 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`76100cdda13bd085beaa94d4b9080fe6f4ee67248976ec9a19c4d58642558a2b`
BLAKE2b-256 checksum How to use checksums	`f44981f92016547077d004a883864da9148e725741f365064a1c9dfe5558f49a`
Upload date	Sep 10, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/MatthiasValvekens/pyHanko
Publishing commit: github.com/MatthiasValvekens/pyHanko/tree/6cd63e82e2ea91e62bdb78d8980c08cc100cdb22

Workflow

Publishing configuration: github.com/MatthiasValvekens/pyHanko/blob/6cd63e82e2ea91e62bdb78d8980c08cc100cdb22/.github/workflows/release.yml
Publishing logs: github.com/MatthiasValvekens/pyHanko/actions/runs/34442484121/attempts/1

Artifact

Subject: pyhanko_certvalidator-0.32.1-py3-none-any.whl
SHA-256 checksum: 76100cdda13bd085beaa94d4b9080fe6f4ee67248976ec9a19c4d58642558a2b Verifying attestations